redline | 2fe936d6b25266ad008ffe359931fc537bfbc3f00774af009c2de5f3abb04e1c

Resubmissions

28-01-2023 03:33

28-01-2023 03:25

max time kernel
144s
max time network
153s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28-01-2023 03:33

Target

Redline_20_2_crack/Kurome.Builder/build.exe
Size

95KB
MD5

1e3c9cf83f86db542cc3ac25b6f2c770
SHA1

1644e0873bd38963da736a0634bab409fd005f5e
SHA256

8ba73686307badd04f852cde0f60f8784cbe9da07c7abff521b63c9612f6e5a0
SHA512

32a4dd6d1db83dee9ff83f8d74b98327c5e3d3e6050f7dff8734d21a49981e3c1a4ef366f13292bf29e88a7ffdb35724861e53dbfe1ef05989947c7ec5448759
SSDEEP

1536:5qsCbqDylbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2x3tmulgS6p8l:XEwiYj+zi0ZbYe1g0ujyzdN8

Score

10^/10

Family

redline

Botnet

cheat

194.145.138.85:28105

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral11/memory/1284-54-0x00000000010A0000-0x00000000010BE000-memory.dmp	family_redline

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

build.exe

description pid process

Token: SeDebugPrivilege 1284 build.exe

description	pid	process
Token: SeDebugPrivilege	1284	build.exe

C:\Users\Admin\AppData\Local\Temp\Redline_20_2_crack\Kurome.Builder\build.exe
"C:\Users\Admin\AppData\Local\Temp\Redline_20_2_crack\Kurome.Builder\build.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1284

memory/1284-54-0x00000000010A0000-0x00000000010BE000-memory.dmp

Filesize
120KB

Download
memory/1284-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download